Carphone Warehouse issued £400,000 fine for data protection failure

Carphone Warehouse has been issued with one of the largest fines by the Information Commissioner’s Office (ICO), after one of its computer systems was compromised as a result of a cyber-attack in 2015.

The company’s failure to secure the system allowed unauthorised access to the personal data of over three million customers and 1,000 employees.

The records for some Carphone Warehouse employees, including name, phone numbers, postcode and car registration were also accessed.

The ICO considered that the personal data involved would significantly affect individuals’ privacy, leaving their data at risk of being misused.

Information Commissioner Elizabeth Denham said: “A company as large, well-resourced and established as Carphone Warehouse should have been actively assessing its data security systems and ensuring systems were robust and not vulnerable to such attacks.

“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

Following a detailed investigation, the ICO identified multiple inadequacies in Carphone Warehouse’s approach to data security and determined that the company had failed to take adequate steps to protect the personal information.

The incident also exposed inadequacies in the organisation’s technical security measures. Important elements of the software in use on the systems affected were out of date and the company failed to carry out routine security testing. There were also inadequate measures in place to identify and purge historic data.

The ICO considered this to be a serious contravention of Principle 7 of the Data Protection Act 1998.